@oracle/oraclejet-audit
JET AUDIT FRAMEWORK
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:meta/18.1.0/jetauditmeta.js | AI (source-diff): Large JSON metadata blob for JET audit framework; minified format is expected for this Oracle package. | ai | |
| source-diff | obfuscated-file:rules/jet/oj-tsx-corequired.js | AI (source-diff): Minified rule implementation with Oracle copyright; readable logic, consistent with audit framework build output. | ai | |
| source-diff | obfuscated-file:rules/jet/oj-html-corequired.js | AI (source-diff): Minified rule implementation with Oracle copyright; readable logic, consistent with audit framework build output. | ai | |
| source-diff | obfuscated-file:rules/jet/oj-cca-compjson-prop-conflict.js | AI (source-diff): Minified rule implementation with Oracle copyright; readable logic, consistent with audit framework build output. | ai | |
| source-diff | obfuscated-file:rulepacks/jetwc/jetwc-use-public-apis.js | AI (source-diff): Minified rule implementation with Oracle copyright; readable logic, consistent with audit framework build output. | ai | |
| source-diff | obfuscated-file:meta/19.0.0/jetauditmeta.js | AI (source-diff): Large JSON metadata blob for JET audit framework; minified format is expected for this Oracle package. | ai | |
| source-diff | obfuscated-file:meta/20.1.0/jetauditmeta.js | AI (source-diff): Minified JSON metadata blob for Oracle JET audit framework; not obfuscated malicious code. | ai | |
| source-diff | obfuscated-file:meta/20.0.0/jetauditmeta.js | AI (source-diff): Oracle JET metadata bundle; long lines are minified component registry data, not obfuscated malicious code. Stable pattern for this package. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Audit/lint framework with plugin/rule loader pattern; dynamic require is expected and stable across versions. | ai | |
| phantom-deps | phantom-dep:line-column | AI (phantom-deps): line-column is declared in package.json dependencies; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:es-abstract | AI (phantom-deps): es-abstract is declared in package.json dependencies; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:parserlib | AI (phantom-deps): parserlib is declared in package.json dependencies; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:astring | AI (phantom-deps): astring is declared in package.json dependencies; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:eval-usage | AI (semgrep): eval() in metaLoader.js reads local filesystem meta files; consistent with a build-time audit tool, not supply-chain risk. | ai |
Versions (showing 30 of 30)
| Version | Deps | Published |
|---|---|---|
| 20.1.3 | 25 / 3 | |
| 20.1.2 | 25 / 3 | |
| 20.1.1 | 25 / 3 | |
| 20.1.0 | 25 / 3 | |
| 20.0.6 | 25 / 3 | |
| 20.0.5 | 25 / 3 | |
| 20.0.4 | 25 / 3 | |
| 20.0.3 | 25 / 3 | |
| 20.0.2 | 25 / 3 | |
| 20.0.1 | 25 / 3 | |
| 20.0.0 | 25 / 3 | |
| 19.0.8 | 25 / 3 | |
| 19.0.7 | 25 / 3 | |
| 19.0.6 | 25 / 3 | |
| 19.0.5 | 25 / 3 | |
| 19.0.4 | 25 / 3 | |
| 19.0.3 | 25 / 3 | |
| 19.0.2 | 25 / 3 | |
| 19.0.1 | 25 / 3 | |
| 18.1.10 | 25 / 3 | |
| 18.1.9 | 25 / 3 | |
| 18.1.8 | 25 / 3 | |
| 18.1.7 | 25 / 3 | |
| 18.1.6 | 25 / 3 | |
| 18.0.15 | 25 / 3 | |
| 18.0.14 | 25 / 3 | |
| 18.0.13 | 25 / 3 | |
| 18.0.12 | 25 / 3 | |
| 18.0.11 | 25 / 3 | |
| 18.0.10 | 25 / 3 |
v20.1.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (meghana-vadlapally) than the most recent previously approved version (smadeghe-orcl) on 2026-07-15, but meghana-vadlapally is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v20.0.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.0.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.0.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v20.0.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.0.5
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v19.0.4
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (wlouie-orcl) than the most recent previously approved version (smadeghe-orcl) on 2026-03-18, but wlouie-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v19.0.3
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (smadeghe-orcl) than the most recent previously approved version (wlouie-orcl) on 2026-02-20, but smadeghe-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v19.0.2
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (wlouie-orcl) than the most recent previously approved version (smadeghe-orcl) on 2026-01-21, but wlouie-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v19.0.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v18.1.10
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (smadeghe-orcl) than the most recent previously approved version (meghana-vadlapally) on 2026-07-09, but smadeghe-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v18.1.8
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v18.1.7
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (smadeghe-orcl) than the most recent previously approved version (wlouie-orcl) on 2026-02-19, but smadeghe-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v18.1.6
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (wlouie-orcl) than the most recent previously approved version (smadeghe-orcl) on 2026-01-23, but wlouie-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v18.0.15
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (smadeghe-orcl) than the most recent previously approved version (meghana-vadlapally) on 2026-07-09, but smadeghe-orcl is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v18.0.13
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (meghana-vadlapally) than the most recent previously approved version (wlouie-orcl) on 2026-03-18, but meghana-vadlapally is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v18.0.12
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v18.0.11
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v18.0.10
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.